Pro-Kremlin network spreads fake Politico tomato hoax
Free public brief. The indicators, the detections with Splunk and KQL already written, and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
DFRLab traced a coordinated pro-Kremlin disinformation campaign that fabricated a Politico story about EU rejecting Armenian tomatoes, spreading it in 18 languages within 29 hours.
DFRLab and CivilNet documented a coordinated influence operation that fabricated a Politico news story claiming the EU had rejected Armenian tomato imports, inverting the actual fact that Russia had embargoed Armenian agricultural goods ahead of Armenia's June 2026 parliamentary elections while the EU opened its market. The false claim was seeded on a Russian-language Telegram channel (@indeec_1937) on July 22, 2026, and within minutes appeared on a verified X account (@SprinterPress, part of the pro-Kremlin 'Sprinter' network) and spread to Space.ru mirrors, Facebook groups, and Belarusian state TV. The operation exploited genuine Armenian farmer protests to push narratives discrediting PM Pashinyan and the EU, timed to undermine Armenia's westward orientation.
Analysts used the Erebus Toolkit and byte-level image hashing to establish coordination across four platforms (Telegram, X, Facebook, VK), identifying automated translation pipelines, synchronized multilingual posting clusters (Russian-German-French within 30 seconds, 413 instances observed over two months), and fixed-sequence amplification chains involving Armenian outlet Past.am and four Telegram channels. Key amplifiers included pro-Kremlin military blogger Yury Podolyaka (73 posts across 64 channels), the ANNA NEWS Telegram channel, the Pravda Network mirror sites, and 74 X accounts with documented ties to the Storm-1516 influence operation targeting Armenia and the Baltic states. The false story reached eighteen languages, including Korean and Vietnamese, within 29 hours, with word-for-word identical text indicating centralized translation and distribution rather than organic spread.
For defenders and trust & safety teams, the report is valuable less for its specific claim than for the reusable disinformation infrastructure it exposes: persistent mirror sites, automated cross-posting bots with near-zero-second republication latency, page-like inauthentic Facebook accounts, and verified/high-follower X accounts pre-positioned to amplify Kremlin-aligned narratives on demand. This infrastructure predates the campaign and remains active, meaning similar fabricated-attribution hoaxes attacking other countries' EU/Western relations should be expected using the same channels and techniques.
Mentioned in this report
Source reporting: https://dfrlab.org/2026/09/29/russia-banned-armenian-tomatoes-a-fake-politico-story-blamed-europe
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections with the Splunk SPL and Microsoft KQL already written, the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 11,316 reports from 152 sources, 2,734 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs